EP2144416A1 - Appareil de gestion de réseau mobile et appareil de gestion d'informations mobiles pour le contrôle des demandes d'accès - Google Patents

Appareil de gestion de réseau mobile et appareil de gestion d'informations mobiles pour le contrôle des demandes d'accès Download PDF

Info

Publication number
EP2144416A1
EP2144416A1 EP09174939A EP09174939A EP2144416A1 EP 2144416 A1 EP2144416 A1 EP 2144416A1 EP 09174939 A EP09174939 A EP 09174939A EP 09174939 A EP09174939 A EP 09174939A EP 2144416 A1 EP2144416 A1 EP 2144416A1
Authority
EP
European Patent Office
Prior art keywords
mobile
network
home network
access request
managing apparatus
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP09174939A
Other languages
German (de)
English (en)
Other versions
EP2144416B1 (fr
Inventor
Jun Hirano
Keigo Aso
Chun Keong Benjamin Lim
Chan Wah Ng
Tien Ming Benjamin Koh
Pek Yew Tan
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Panasonic Intellectual Property Corp of America
Original Assignee
Panasonic Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Panasonic Corp filed Critical Panasonic Corp
Publication of EP2144416A1 publication Critical patent/EP2144416A1/fr
Application granted granted Critical
Publication of EP2144416B1 publication Critical patent/EP2144416B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2803—Home automation networks
    • H04L12/283—Processing of data at an internetworking point of a home automation network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/2898—Subscriber equipments
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2803—Home automation networks
    • H04L12/2816—Controlling appliance services of a home automation network by calling their functionalities
    • H04L12/2818—Controlling appliance services of a home automation network by calling their functionalities from a device located outside both the home and the home network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/005—Moving wireless networks

Definitions

  • the present invention relates to a mobile network managing apparatus and a mobile information managing apparatus which execute communication using a mobile communication network, and, particularly, to a mobile network managing apparatus and a mobile information managing apparatus which execute access control to improve the securities of a personal mobile communication network and a home network.
  • the concept of network mobility allows users to be contacted even when they are away from their homes (out of homes).
  • Non-patent Document 1 A typical technique to allow such an action to be achieved is one using mobile IP as defined in " Mobility Support in IPv6", Internet Engineering Task Force Request For Comments 3775, June in 2004 (hereinafter "Non-patent Document 1").
  • the connectivity is transferred from the user's home DSL line (cable connection) over to a cellular access system (wireless connection).
  • the switching from the cable connection to the wireless connection can permit the user to continue downloading a file or conducting a voice over IP (VoIP) conversation.
  • VoIP voice over IP
  • a user can move around with a mobile device, and can keep seamless network connectivity even when the user is out of home by switching to a wireless connection point.
  • Non-patent Document 2 a network mobility (NEMO) as defined in " Network Mobility (NEMO) Basic Support Protocol", Internet Engineering Task Force Request For Comments 3963, January in 2005 (hereinafter "Non-patent Document 2").
  • NEMO network mobility
  • Nodes within the mobile PAN are able to communicate with other global nodes by routing their intended data traffic through mobile routers (MR) that are located within the mobile PAN.
  • MR mobile routers
  • the MR registers its current location address, also known as Care-of-Address (CoA) with a home agent (HA; mobile information managing apparatus).
  • the home agent (HA) functions as a router within the user's home network and intercepts packets destined for the home address of the mobile node, encapsulates the packets, and tunnels the encapsulated packets to the registered CoA of the mobile node.
  • a bi-directional tunnel is established between the MR and the HA to permit packets to be sent to each other via the bi-directional tunnel.
  • every traffic originating from and terminating at the mobile PAN is sent via the bi-directional tunnel.
  • VN visitor node
  • a VN may be authorized by the user to access data located within the user's home network (for example, music files present in the user's home media server).
  • data located within the user's home network for example, music files present in the user's home media server.
  • various security policies to which the VN must conform to should be configured before the VN is allowed to access the user's home network.
  • a policy server located within the DMZ (De-Militarized Zone), which is situated between the user's home network and a foreign network, can implement such security policies for the VNs, as defined in " Benchmarking Terminology for Firewall Performance", Internet Engineering Task Force Request For Comments 2647, August in 1999 (hereinafter "Non-patent Document 3").
  • the DMZ is situated between the user's home domain and the global Internet.
  • Patent Document 1 proposes a method of allowing a correspondent node (CN) located within the home network to establish a secure communication channel with a mobile node (MN) that is attached on a foreign link.
  • a mobile IP proxy along with a VPN (Virtual Private Network) server located within the DMZ will allow the MN and the CN to establish a secure tunnel therebetween.
  • VPN Virtual Private Network
  • Non-patent Document 3 As every traffic within the mobile PAN is tunneled between the MR and HA, a VN's packet will therefore bypass the policy server within the DMZ and thus the various security policies that have been set by the user will not be implemented.
  • the mobile IP proxy acts as a surrogate HA to the MN and a surrogate MN to the HA. This would mean that the mobile IP proxy would need to have knowledge of security association keys of both the MN and HA.
  • the technique of Patent Document 1 has not taken into account, access control of the VN connected under the control of the MR located in a foreign network.
  • VN visitor node
  • a mobile network managing apparatus for controlling and moving with a mobile network, comprising:
  • a visitor node (VN) connected to a mobile network can be identified, and the security managing apparatus (policy server) can perform access control to govern the rights of the visitor node to gain access to the home network.
  • policy server policy server
  • the mobile network managing apparatus of the invention is configured to include:
  • This structure can store information indicating if the node is a visitor node at the point of time in which the node is connected to a mobile network, and identify whether or not a communication terminal which has made an access request is a visitor node by using the information.
  • the mobile network managing apparatus of the invention includes:
  • This structure allows the prefix of an address to be assigned to a visitor node different from that of the home user's node, making it possible to identify whether or not a communication terminal which has made an access request is a visitor node by referring to the prefix of the address of the sender having made an access request.
  • the mobile network managing apparatus of the invention includes:
  • This structure allows the mobile network managing apparatus (mobile router) to forward an access request received from a communication terminal under the control of the mobile network managing apparatus (mobile router) to the mobile information managing apparatus (home agent) or the security managing apparatus (policy server) in a secure state without changing the access request.
  • a mobile network managing apparatus for controlling and moving with the mobile network, comprising:
  • This structure makes it possible to identify a visitor node (VN) connected to a mobile network by means of adding index information to an access request to the home network from the visitor node.
  • the presence of the index information indicates that the access request is made from a visitor node.
  • the mobile network managing apparatus of the invention includes:
  • This structure can store information indicating that the node is a visitor node at the point of time in which the node is connected to a mobile network.
  • the information also allows a means to identify whether or not a communication terminal which has made an access request is a visitor node.
  • the mobile network managing apparatus of the invention includes:
  • This structure allows a visitor node and a home user's node to make use of a different address prefix for communication means in the home network.
  • this makes it possible to identify whether or not a communication terminal which has made an access request is a visitor node by referring to the prefix used in the address.
  • the mobile network managing apparatus of the invention includes:
  • This structure can allow the mobile network managing apparatus (mobile router) to forward an access request received from a communication terminal under the control of the mobile network managing apparatus (mobile router) to the mobile information managing apparatus (home agent) in a secure state without changing the access request.
  • a mobile information managing apparatus that performs mobile management of a communication terminal attempting to directly access a home network, comprising:
  • the mobile information managing apparatus can identify whether or not a communication terminal which has made an access request is a visitor node by referring to the prefix of the address of the sender having made an access request.
  • a mobile information managing apparatus that performs mobile management of a communication terminal attempting to access directly a home network, comprising:
  • the mobile information managing apparatus can identify whether or not a communication terminal which has made an access request is a visitor node by referring to the index information.
  • the mobile information managing apparatus of the invention includes:
  • This structure can allow the mobile network managing apparatus (mobile router) to forward an access request received from a communication terminal under control to the security managing apparatus (policy server) in a secure state without changing the access request.
  • mobile network managing apparatus mobile router
  • policy server security managing apparatus
  • the invention with the above-described structure has an advantage such that it is possible to ensure proper execution of access control based on various security policies set by a home user with regards to packets sent from a visitor node (VN).
  • VN visitor node
  • Fig. 1 is a diagram illustrating a preferable example of the configuration of a mobile router (MR) according to one embodiment of the invention.
  • a MR 10 shown in Fig. 1 comprises of an access interface 11, which allows the MR 10 to transmit packets to other nodes and receive packets therefrom.
  • the access interface 11 may be Wi-Fi (Wireless Fidelity), Bluetooth (registered trademark) or Cellular (cell phone) as an example, but is not restricted to those interfaces.
  • the access interface 11 sends and receives packets to and from a processor 12 via a path 15.
  • the MR 10 further includes the processor '12, which processes incoming and outgoing packets.
  • the processor 12 executes a process of forming bi-directional tunnels and a process of generating binding updates for the MR 10.
  • the processor 12 executes a process on binding acknowledgements received from its home agent and a process of updating a binding update list stored in a data storage 14.
  • the processor 12 sends a signal via a path 16 to a key generator 13 located within the MR 10.
  • the key generator 13 receives the signal, the key generator 13 generates keys needed for the processor 12 and sends the keys to the processor 12 via the path 16.
  • the MR 10 includes the data storage 14, which stores information required by the MR 10.
  • the data storage 14 is connected via a path 17 to the processor 12, which stores and reads information into and from the data storage 14.
  • Information stored in the data storage 14 may be the prefix of a home address (which hereinafter may also be called home address prefix), a binding update list or the prefix of a mobile network, as one example, but is not limited to those information.
  • Fig. 2 is a diagram illustrating a preferable example of the configuration of the home agent (HA) of the preferred embodiment of the invention.
  • the HA 20 shown in Fig. 2 includes an access interface 21, which allows the HA 20 to transmit packets to other nodes or receive packets therefrom.
  • the access interface 21 may be Ethernet (registered trademark), Wi-Fi or Cellular (cell phone), but is not restricted to those interfaces.
  • the access interface 21 sends and receives packets to and from a processor 22 via a path 25.
  • the processor 22 located within the HA 20 has functions such as processing of incoming and outgoing packets from the path 25 and forming of bi-directional tunnels.
  • the HA 20 further has the functions of processing binding update messages sent from the MR 10, updating a binding update cache stored in the data storage 14 via a path 27 and sending binding acknowledgements to the MR 10.
  • the HA 20 further has a key generator 23 which, upon reception of a signal from the processor 22 via a path 26, generates necessary keys and sends the keys to the processor 22 via the path 26.
  • the HA 20 further has a data storage 24, which stores information required by the HA 20.
  • Information stored in the data storage 24 may be a home address prefix, a binding update cache or a mobile network prefix, as an example, but is not restricted to those information.
  • Fig. 3 is a diagram illustrating one example of the communication system according to the preferred embodiment of the invention.
  • a mobile personal area network (PAN) 30 includes a visitor node (VN) 31, which functions as a foreign node within the mobile PAN 30.
  • the VN 31 may be a mobile node or a fix node.
  • the mobile PAN 30 further includes a mobile router (MR) 10, which routes all traffic within the mobile PAN 30.
  • MR mobile router
  • CN Correspondent Node
  • the MR 10 may directly send packets to the CN, but will route all traffic within the mobile PAN 30 to the home agent (HA) 20 in this embodiment.
  • the VN 31 is connected to the mobile router (MR) 10 and would be authorized to function within the mobile PAN 30.
  • the MR 10 and the HA 20 establish a bi-directional tunnel 37a through an access system 32 to allow traffic to be routed therebetween.
  • the access system 32 may be but not restricted to the Internet, a cellular network, etc.
  • the MR 10 and the policy server 36 establish another bi-directional tunnel 37c through the access system 32 for routing traffic between each other.
  • the bi-directional tunnel 37c is needed, for example, in a mode where the MR 10 forwards packets to the policy server 36, as will be described later, but need not be established in a mode where the MR 10 forwards packets only to the HA 20.
  • a home network 33 includes an HA 20, which forwards all packets destined for the MR 10 thereto, thereby allowing the MR 10 to remain reachable even when it is not within the home network 33.
  • the HA 20 maintains an update of the current Care-of-Address (CoA) and establishes the bi-directional tunnel 37a to the MR 10 for routing traffic.
  • the HA 20 communicates with the policy server 36 for routing traffic to each other.
  • the HA 20 may establish a bi-directional tunnel 37b with the policy server 36.
  • the home network 33 further includes a media server 34.
  • the media server 34 contains data 34a of the home user to which the VN 31 wishes to gains access.
  • the data 34a may be audio files or video files or the like, but not restricted to those file types.
  • a DMZ (De-Militarized Zone) 35 is provided for the home network 33.
  • the DMZ 35 includes the policy server 36, which contains security policies 36a that would be effected upon reception of data packets from the VN 31.
  • the policy server 36 may be one or a plurality of servers located within the DMZ 35, but is not restricted to this structure.
  • the policy server 36 may have the function of the firewall gateway.
  • the security policy 36a has the format of Extended Markup Language (XML), but is not restricted thereto.
  • the security policies 36a may be user implemented policies, but are not restricted thereto.
  • the MR 10 When the MR 10 is within the home network 33, the MR 10 performs an operation of obtaining one home address prefix or multiple home address prefixes from the HA 20 to determine the home address of the MR 10. In this case, once the MR 10 obtains the prefix the home address, the MR 10 uses stateless address auto-configuration to configure a unique home address and registers the unique home address with the HA 20.
  • the home address of the MR 10 can be set by an arbitrary method, such as manual presetting.
  • the MR 10 is able to broadcast one home address prefix or multiple home address prefixes obtained from the HA 20 within the mobile PAN 30. Nodes connected to the MR 10 then can use the broadcast prefix(es) to configure their unique home addresses.
  • the nodes that are connected to the MR 10 may be visitor nodes (VN) 31 or home user nodes, but are not restricted thereto.
  • VN visitor nodes
  • the MR 10 can allocate different prefixes to a home user node, a local fixed node (LFN) fixed within the mobile PAN 30 and the VN 31 which is targeted for access control.
  • LPN local fixed node
  • the MR 10 When the MR 10 leaves the home network 33 and is connected to a foreign link, the MR 10 acquires a care-of-address (CoA) from the connected AR (Access Router).
  • CoA care-of-address
  • the MR 10 attempts to establish a bi-directional tunnel with the HA 20 by performing a security association therewith.
  • the method of establishing a security association between the MR 10 and the HA 20 may be but not restricted to internet key exchange (IKE).
  • the MR 10 will then perform a process of sending a binding update (BU) message to the HA 20 to update the address at the current point.
  • BU binding update
  • the HA 20 checks if the BU message is from a valid home user before updating its BU cache. Then, the HA 20 will associate the unique home address of the MR 10 with the current CoA of the MR 10.
  • the HA 20 will forward to the MR 10 information about the policy server 36 within the DMZ 35.
  • the HA 20 informs the mobile router of information on the policy server 36 within the DMZ 35 will be described.
  • the processes relating to Fig. 4A and Fig. 4B are that the MR 10 acquires information to establish the bi-directional tunnel 37c (information on the policy server 36) with the policy server 36. These steps are optional and need not be executed when either the MR 10 contains information on the policy server 36 beforehand or when establishing the bi-directional tunnel 37c is not necessary.
  • Fig. 4A shows a sequence chart illustrating one example of how the HA 20 informs the mobile router of information on the policy server 36 within the DMZ 35 according to the preferred embodiment of the invention.
  • Fig. 4A when the MR 10 registers the current CoA with the HA 20, the HA 20 will forward information on the policy server 36 within the DMZ 35 (described as PS Info in Fig. 4A ) to the MR 10 (step S40).
  • Information on the policy server 36 is the address of the policy server 36 or a security association key, but is not restricted those information. The address may be but not restricted to an IP address.
  • the MR 10 stores the address of the policy server 36 in the data storage 14 and replies the HA 20 with an acknowledgement (described as Ack in Fig. 4A ) (step S41). At this time, the MR 10 can use the security association key to form the bi-directional tunnel 37c with the policy server 36.
  • Fig. 4B shows the sequence chart illustrating another example of on how the HA 20 informs the mobile router of information on the policy server 36 within the DMZ 35 according to the preferred embodiment of the invention.
  • the HA 20 holds and periodically updates a list of available policy sever(s) 36 within the DMZ 35.
  • the list of the policy server(s) 36 is stored within the data storage 24. This would therefore allow the HA 20 to perform load balancing between a plurality of policy servers when there are a plurality of policy servers 36.
  • the MR 10 sends a request for information on the policy service 36 (described as PS Info in Fig. 4B ) to the HA 20 (step S42) .
  • the HA 20 processes the request (step S43) and checks which policy server 36 is available by referring to the list of the policy server(s) 36.
  • the HA 20 decides the policy server 36 that will handle the packets of the MR 10, the HA 20 makes a response to the MR 10. Because subsequent processes are the same as steps 40 and 41 shown in Fig. 4A , their descriptions will be omitted.
  • a visitor node (VN) 31 is a node that is foreign to the mobile PAN 30.
  • VN 31 attempts to be connected to the mobile PAN 30 by communicating with the MR 10.
  • the VN 31 receives an RA (Router Advertisement) form the MR 10 including the home prefix which can be used by the mobile PAN 30.
  • the MR 10 may assign a home prefix (prefix for the VN 31) different from a home prefix to be assigned to the home user's node to the VN 31.
  • the VN 31 may send an RS (Router Solicitation) request to the MR 10 to obtain the home prefix. After acquiring the home prefix, the VN 31 configures a valid address to operate within the mobile PAN 31.
  • the MR 10 executes a process to authenticate the VN 31.
  • Authentication of the VN 31 may be but not restricted to 802. 1x shared key authentication. It is desirable that home users nodes within the mobile PAN 30 should share a pre-shared secret with the MR 10.
  • the MR 10 When the MR 10 has identified that the VN 31 is a foreign node within the mobile PAN 30, the MR 10 stores information on the VN 31 in the date storage 14. The above-described operation connects the VN 31 to the mobile PAN 30.
  • the data 34a located in the media server 34 within the home network 33 is data accessible by any node which is located within the mobile PAN 30, and the VN 31 can access the data 34a.
  • Fig. 5 shows a description will be given of the case of using both the bi-directional tunnel 37a established between the MR 10 and the HA 20 and the bi-directional tunnel 37c established between the MR 10 and the policy server 36. While Fig. 5 illustrate the state where the bi-directional tunnel 37b is established between the HA 20 and the policy server 36, the bi-directional tunnel 37b should not necessarily be established between the HA 20 and the policy server 36.
  • Fig. 5 shows a sequence chart illustrating one example of a process of file transfer to the VN 31 according to the preferred embodiment of the invention.
  • the VN 31 attempts to retrieve the data 34a from the medial server 34, and sends a file request to the MR 10 (step S50).
  • the MR 10 processes the request (step S51), and determines if the sender of the file request is the home user node or the VN 31 within the mobile PAN 30.
  • the MR 10 can refuse the file request at this point of time.
  • the MR 10 can specify whether the sender of the file request is the home user node or a foreign node (i.e., the VN 31) by referring to information on the VN 31 stored in the data storage 14 by the MR 10 at the time of authenticating the VN 31.
  • the MR 10 When the MR 10 is configured to assign a prefix different from that of the home user node to the VN 31, the MR 10 can specify whether the sender of the file request is the home user node or a foreign node (i.e., the VN 31) by referring to the prefix of the address of the sender of the file request.
  • the method of determining whether the sender of the file request is the home user node or the VN 31 in the mobile PAN 30 is not limited to the above-described method.
  • the MR 10 encapsulate the file request message and tunnels the file request message to the policy server 36 in the DMZ 35 via the bi-directional tunnel 37c (step S52).
  • the packet from the MR 10 is de-capsulated and the file request message is processed in consideration of the security policy 36a (step S53).
  • the policy server 36 forwards the file request message to the media server 34 (step S54).
  • the policy server 36 may encapsulate the file request message before forwarding the file request message to the media server 34.
  • the policy server 36 sends the MR 10 a response in the form of a message to refuse the file request.
  • the policy server 36 can function as the home agent of the VN 31.
  • the policy server 36 can forward the file request message to the media server 34 via the HA 20.
  • the media server 34 processes the file request message (step S55) to determine if the request is from an authorized entity.
  • the media server 34 forwards the requested file to the HA 20 (step S56), and the HA 20 then tunnels the file to the MR 10 via the bi-directional tunnel 37a (step S57).
  • the MR 10 Upon reception of the file, the MR 10 forwards the file to the VN 31 (step S58).
  • the MR 10 may form a bi-directional tunnel with the media server 34 using the path optimization technique, so that the data 34a is securely transferred between the MR 10 and the media server 34.
  • Fig. 5 illustrates the process when the VN 31 has made a file request
  • the home user node may make a file request.
  • the MR 10 specifies that the sender of the file request is the home user node, encapsulates the file request message, and sends the file request message to the HA 20 via the bi-directional tunnel 37a.
  • the VN 31 sends a packet destined for a foreign network (i.e., a network other than the home network 33)
  • the packet is supplied to the HA 20 after the policy server 36 checks that the packet is not destined for the home network 33, and the packet is then forwarded to the foreign network.
  • the MR 10 has only to establish the bi-directional tunnel 37a with the HA 20. That is, in this case, the MR 10 need not establish the bi-directional tunnel 37c with the policy server 36.
  • the MR 10 identifies which packet has been sent from the home user node and which packet has been sent from the VN 31, and then forwards the packet to the HA 20.
  • the above-described methods are available as a method of determining whether the packet sender is the home user node or the VN 31.
  • a packet to be forwarded to the HA 20 from the MR 10 is tagged as shown in, for example, Fig. 6 .
  • Fig. 6 shows one example of a packet structure for tagging a packet to distinguish between a packet from a home user node and a packet from a VN according to the preferred embodiment of the invention.
  • the MR 10 tags the packet by encapsulating the packet and adding a mark 60 in a header portion 61 of the mobile IP (MIP).
  • MIP mobile IP
  • a packet received from an arbitrary node in the mobile PAN 30 is encapsulated by a payload portion 62.
  • the MR 10 determines whether the packet sender is the home user node or the VN 31 before or at the same time as encapsulating the packet, and adds information to identify the home user node or the VN 31 as the mark 60 into the header portion 61 of the mobile IP based on the determination result.
  • the mark 60 may be but not restricted to an address prefix, a token or a flag bit. While the mark 60 is added to the header portion 61 after encapsulation, the mark 60 may be added at any position identifiable by the HA 20 which receives the packet transferred from the MR 10.
  • Fig. 7 shows a sequence chart illustrating one example of a process of transferring a file request from the VN 31 according to the preferred embodiment of the invention.
  • the sequence chart of Fig. 7 unlike the one shown in Fig. 5 , does not use the bi-directional tunnel 37c between the MR 10 and the policy server 36.
  • communication between the HA 20 and the policy server 36 are carried out via the bi-directional tunnel 37b; however, a tunnel should not necessarily be used in communication between the HA 20 and the policy server 36.
  • the MR 10 receives a file request message from the VN 31 to access data 34a located within the media server 34 (step S70).
  • the MR 10 processes the file request message (step S71) to determine whether the sender of the file request message is the home user node or the VN 31 in the mobile PAN 30.
  • the packet is tagged by encapsulating the packet and adding the mark 60 indicating that the packet has come from the VN 31 in the mobile PAN 30. Then, the MR 10 tunnels the tagged file request message to the HA 20 via the bi-directional tunnel 37a (step S72).
  • the mark 60 indicating that the packet has not come from the home user node is added to the packet.
  • the HA 20 receives and processes the tagged file request message (step S73) and identifies that the packet has been tagged as a packet from the VN31.
  • the HA 20 then sends the file request message to the policy server 36 (step S74).
  • the HA20 uses' the bi-directional tunnel 37b, the HA 20 tunnels the file request message to the policy server 36.
  • the HA 20 may forward packets from the home user node to the media server 34 soon.
  • the policy server 36 receives (then decapsulates) the file request message and executes a process in consideration of the security policies (step S75).
  • the policy server 36 checks that the file request message is from the authorized VN 31, the policy server 36 forwards the request file message to the media server 34 (step S76).
  • the policy server 36 sends the MR 10 a response in the form of a message to refuse the file request.
  • the policy server 36 can forward the file request message via the HA 20 to the media server 34. Because the processes at the time the requested file is sent to the VN 31 from the media server 34 are the same as the processes of steps S55 to S58 shown in Fig. 5 , their descriptions will be omitted.
  • the MR 10 may forward the file request message directly to the HA 20, so that the HA 20 refers to the prefix of the address of the sender of the file request message to identify whether the sender of the file request message is the home user node or a foreign node (i.e., the VN 31).
  • the MR 10 can prepare an RA message including the prefix for the home user node and an RA message including the prefix for the foreign node.
  • the MR 10 performs some encryption scheme so as to permit only the home user node to decrypt the RA message including the prefix for the home user node, thereby notifying the home user node and the foreign node of different prefixes.
  • the method of notifying the home user node and the foreign node of different prefixes is not limited to the foregoing method.
  • the VN 31 connected to the mobile PAN 30 accesses the home network 33 of the mobile PAN 30, it is possible to always use the security policy 36a via the policy server 36 in the DMZ 35.
  • the HA 20 and the policy server 36 are different entities in the embodiment of the invention, the HA 20 and the policy server 36 may be realized by the same entity.
  • HA 20 can use the mark added to a packet HA 20 receives to perform flow filtering. For example, the user sets a filter policy at HA 20 indicating that packets from the home user node should be given priority over packets from visitor nodes in terms of processing at HA 20. Thus, HA 20 checks the mark 60 located within each packet HA 20 receives and executes the filter rules accordingly. If the mark 60 indicates that the packet is from a home user node, HA 20 places this packet into a packet queue meant for packets for home user node. However, if the mark 60 indicates that the packet is from a visitor node, HA 20 places this packet into a packet queue meant for packets for visitor node. HA 20 would process any packets found in the home user node queue first before processing packets located within the queue for visitor nodes. The advantage of performing such filtering allows the home user to ensure that all nodes belonging to the home user are ensured of fast service.
  • a mobile network provides mobile nodes with transparent connectivity to a home network
  • connecting management similar to the security policy set by the policy server should be implemented for a mobile node which is connected to the mobile network and a user should know that authorization of a visitor node to be connected to a mobile network is equivalent to authorization of a visitor node to be connected to the home network.
  • those skilled in the art who take such consideration may think that surely selecting a mobile node connectable to a mobile network does not bring about the situation to which the invention is directed.
  • the invention can be adapted to a case where it is difficult to provide sufficient connecting management for a mobile network due to problems, such as the processing performance and power consumption of a mobile router or a mobile network node, and a case where a user who is not well acquainted with the security in a mobile network can use the mobile network safely.
  • LSI Large Scale Integration
  • the functional blocks may each be configured as a single chip, or some or all of the blocks may be configured as a single chip. While LSI is used herein, it may also be called an IC (Integrated Circuit), a system LSI, a super LSI, an ultra LSI, depending on the degree of integration.
  • IC Integrated Circuit
  • the scheme for circuit integration is not limited to LSI, but an exclusive circuit or a general-purpose processor may be used.
  • An FPGA Field Programmable Gate Array
  • An FPGA Field Programmable Gate Array which is programmable after LSI or a reconfigurable processor designed to be able to reconfigure the connections and settings of circuit cells in the LSI may be used.
  • circuit integration of the functional blocks can of course be done using such a technique.
  • adaptation of the biotechnology or the like is possible.
  • the invention has an effect of allowing accurate execution of access control based on various security policies set by a home user with regard to a packet sent from a visitor node (VN), and is adaptable to a communication technique which performs communication using a mobile communication network and an access control technique to improve the security in a personal mobile communication network and a user's home network.
  • VN visitor node
EP09174939.0A 2005-12-26 2006-12-26 Appareil de gestion de réseau mobile et appareil de gestion d'informations mobiles pour le contrôle des demandes d'accès Active EP2144416B1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2005373126 2005-12-26
EP06843730.0A EP1966970B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces

Related Parent Applications (2)

Application Number Title Priority Date Filing Date
EP06843730.0A Division EP1966970B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces
EP06843730.0A Division-Into EP1966970B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces

Publications (2)

Publication Number Publication Date
EP2144416A1 true EP2144416A1 (fr) 2010-01-13
EP2144416B1 EP2144416B1 (fr) 2017-05-24

Family

ID=37896058

Family Applications (2)

Application Number Title Priority Date Filing Date
EP06843730.0A Active EP1966970B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces
EP09174939.0A Active EP2144416B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de réseau mobile et appareil de gestion d'informations mobiles pour le contrôle des demandes d'accès

Family Applications Before (1)

Application Number Title Priority Date Filing Date
EP06843730.0A Active EP1966970B1 (fr) 2005-12-26 2006-12-26 Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces

Country Status (5)

Country Link
US (1) US8539554B2 (fr)
EP (2) EP1966970B1 (fr)
JP (1) JP4857342B2 (fr)
CN (2) CN101346968B (fr)
WO (1) WO2007077958A1 (fr)

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2876853A1 (fr) * 2004-10-20 2006-04-21 France Telecom Procede d'adressage d'un reseau ip se connectant a un autre reseau ip
US8635307B2 (en) * 2007-02-08 2014-01-21 Microsoft Corporation Sensor discovery and configuration
JPWO2008099802A1 (ja) * 2007-02-13 2010-05-27 日本電気株式会社 移動端末管理システム、ネットワーク機器及びそれらに用いる移動端末動作制御方法
US20100175109A1 (en) * 2007-05-25 2010-07-08 Wassim Haddad Route optimisation for proxy mobile ip
KR100881272B1 (ko) * 2007-07-25 2009-02-05 한국전자통신연구원 Ｐｍｉｐ6 도메인에서의 이동 라우터 관리 시스템 및 방법
EP2020794A1 (fr) * 2007-08-02 2009-02-04 Siemens Aktiengesellschaft Procédé pour l'opération d'un réseau en mouvement
US8238314B2 (en) * 2007-09-27 2012-08-07 Alcatel Lucent Method and apparatus for providing a distributed forwarding plane for a mobility home agent
CN101926149B (zh) 2008-01-29 2014-04-16 艾利森电话股份有限公司 动态策略服务器分配
EP2096828B1 (fr) * 2008-02-26 2012-08-22 Vodafone Holding GmbH Procédé et unité de gestion pour gérer l'accès aux données dans un réseau personnel
CN101272627B (zh) * 2008-04-30 2010-12-22 杭州华三通信技术有限公司 实现漫游的网络接入控制方法及设备
KR101588887B1 (ko) * 2009-02-09 2016-01-27 삼성전자주식회사 멀티-홉 기반의 인터넷 프로토콜을 사용하는 네트워크에서 이동 노드의 이동성 지원 방법 및 그 네트워크 시스템
US20110060816A1 (en) * 2009-04-17 2011-03-10 Prem Jothipragasam Kumar Parameter management in a personal distributed network
WO2012066556A1 (fr) * 2010-11-17 2012-05-24 Ruckus Wireless Inc. Contrôleur de connexion d'accès croisé
JP5804061B2 (ja) 2010-12-02 2015-11-04 日本電気株式会社 通信システム、制御装置、通信方法およびプログラム
WO2012144203A1 (fr) * 2011-04-18 2012-10-26 Nec Corporation Terminal, dispositif de commande, procédé de communication, système de communication, module de communication, programme, et dispositif de traitement d'informations
KR20140002042A (ko) * 2011-04-18 2014-01-07 닛본 덴끼 가부시끼가이샤 단말, 제어 디바이스, 통신 방법, 통신 시스템, 통신 모듈, 프로그램, 및 정보 처리 디바이스
US9202070B2 (en) * 2012-10-31 2015-12-01 Broadcom Corporation Input/output gatekeeping
JP2016521029A (ja) 2013-03-28 2016-07-14 トムソン ライセンシングＴｈｏｍｓｏｎ Ｌｉｃｅｎｓｉｎｇ セキュリティ管理サーバおよびホームネットワークを備えるネットワークシステム、およびそのネットワークシステムにデバイスを含めるための方法
CN103731756B (zh) * 2014-01-02 2016-09-07 中国科学院信息工程研究所 一种基于智能云电视网关的智能家居远程安全访问控制实现方法
EP2899940B1 (fr) * 2014-01-23 2020-06-03 Vodafone GmbH Procédé de connexion d'une connexion sécurisée pour système de dispositif mobile sur un réseau
CN104331029B (zh) * 2014-05-30 2017-11-03 青岛海尔股份有限公司 具有双网络连接方式的除菌除异味控制系统及方法
KR101869347B1 (ko) * 2016-01-26 2018-06-21 한국기초과학지원연구원 네트워크 접속 제어 시스템 및 제어 방법
JP6614081B2 (ja) * 2016-09-16 2019-12-04 京セラドキュメントソリューションズ株式会社 端末装置
US11863348B2 (en) * 2021-07-06 2024-01-02 Cisco Technology, Inc. Message handling between domains

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1209928A2 (fr) * 2000-11-27 2002-05-29 Nokia Corporation Un serveur et un procédé de fournir des contenus en utilisant un serveur
US20040120295A1 (en) 2002-12-19 2004-06-24 Changwen Liu System and method for integrating mobile networking with security-based VPNs
WO2005094037A1 (fr) * 2004-03-09 2005-10-06 Telefonaktiebolaget Lm Ericsson (Publ) Prise en charge de la mobilite de reseau et regulation d'acces pour reseaux mobiles

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6978128B1 (en) * 2001-05-04 2005-12-20 Utstarcom, Inc. System and method to allow simple IP mobile nodes to operate seamlessly in a mobile IP network with true roaming capabilities
JP4186456B2 (ja) * 2001-11-28 2008-11-26 沖電気工業株式会社 分散ファイル共有システムおよびその制御方法
CN1729663B (zh) * 2002-12-26 2010-10-13 松下电器产业株式会社 移动网络控制装置和移动网络控制方法
CN100344199C (zh) * 2003-11-19 2007-10-17 华为技术有限公司 无线局域网网络移动性管理的系统及其方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1209928A2 (fr) * 2000-11-27 2002-05-29 Nokia Corporation Un serveur et un procédé de fournir des contenus en utilisant un serveur
US20040120295A1 (en) 2002-12-19 2004-06-24 Changwen Liu System and method for integrating mobile networking with security-based VPNs
WO2005094037A1 (fr) * 2004-03-09 2005-10-06 Telefonaktiebolaget Lm Ericsson (Publ) Prise en charge de la mobilite de reseau et regulation d'acces pour reseaux mobiles

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
KWON S BAEK S PACK Y CHOI SEOUL NATIONAL UNIVERSITY T: "AAA for NEMO", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, 11 July 2005 (2005-07-11), XP015040493, ISSN: 0000-0004 *
NG PANASONIC SINGAPORE LABS T TANAKA MATSUSHITA COMMUNICATIONS INDUSTRIAL C W: "Usage Scenario and Requirements for AAA in Network Mobility Support", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, October 2002 (2002-10-01), XP015004581, ISSN: 0000-0004 *

Also Published As

Publication number Publication date
EP2144416B1 (fr) 2017-05-24
WO2007077958A1 (fr) 2007-07-12
CN102244868A (zh) 2011-11-16
JP4857342B2 (ja) 2012-01-18
CN101346968B (zh) 2011-10-12
US8539554B2 (en) 2013-09-17
EP1966970A1 (fr) 2008-09-10
US20090313680A1 (en) 2009-12-17
CN101346968A (zh) 2009-01-14
EP1966970B1 (fr) 2017-06-14
JP2009521820A (ja) 2009-06-04

Similar Documents

Publication Publication Date Title
EP1966970B1 (fr) Appareil de gestion de reseau de mobiles et appareil de gestion d'information de mobiles pour gerer les demandes d'acces
US8451752B2 (en) Seamless handoff scheme for multi-radio wireless mesh network
JP4981164B2 (ja) 通信システム及び通信ノード
KR200323896Y1 (ko) 역방향 터널링을 지원하기 위해 직접 및 인캡슐레이션전달을 사용하는 무선 랜
EP1956755A1 (fr) Réduction de surcharge contrôlée d'un réseau de paquets de données par procédure d'optimisation d'itinéraire
EP2272270B1 (fr) Procédé d accès à un réseau, réseau associé et progiciel à cet effet
US20100296443A1 (en) System, method and apparatus for route-optimized communication for a mobile node nested in a mobile network
US20100046419A1 (en) Overlay Network Node, Mobile Node, and Mobile Router
US20100046558A1 (en) Header reduction of data packets by route optimization procedure
JP5016030B2 (ja) デュアルスタック移動体ノードがＩＰｖ４ネットワーク中でローミングするための方法と装置
US20080240053A1 (en) Quality of service (QoS) negotiation between network nodes in a Mobile IP network
US20040025051A1 (en) Secure roaming using distributed security gateways
JP5192032B2 (ja) 異なるモバイルｉｐ配送スタイルのネゴシエーション
JP4506883B2 (ja) 移動通信システム、トラヒック転送装置、トラヒック転送方法及びプログラム
EP1933518A1 (fr) Procede d'optimisation de la communication entre noeuds mobiles
Herbert et al. dmm K. Bogineni Internet-Draft Verizon Intended status: Informational A. Akhavain Expires: January 14, 2019 Huawei Canada Research Centre

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AC Divisional application: reference to earlier application

Ref document number: 1966970

Country of ref document: EP

Kind code of ref document: P

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

17P Request for examination filed

Effective date: 20100526

17Q First examination report despatched

Effective date: 20100624

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AME

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04W 12/08 20090101ALI20161212BHEP

Ipc: H04W 80/04 20090101ALN20161212BHEP

Ipc: H04L 29/06 20060101AFI20161212BHEP

Ipc: H04W 76/02 20090101ALN20161212BHEP

Ipc: H04W 84/00 20090101ALN20161212BHEP

INTG Intention to grant announced

Effective date: 20170103

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AC Divisional application: reference to earlier application

Ref document number: 1966970

Country of ref document: EP

Kind code of ref document: P

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 896508

Country of ref document: AT

Kind code of ref document: T

Effective date: 20170615

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602006052652

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20170524

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 896508

Country of ref document: AT

Kind code of ref document: T

Effective date: 20170524

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170825

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170924

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170824

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602006052652

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20180227

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20171226

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171226

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20180831

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20171231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180102

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171226

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171231

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171226

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171231

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20061226

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170524

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170524

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602006052652

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

REG Reference to a national code

Ref country code: DE

Ref legal event code: R081

Ref document number: 602006052652

Country of ref document: DE

Owner name: APPLE INC., CUPERTINO, US

Free format text: FORMER OWNER: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA, TORRANCE, CALIF., US

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230526

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20231031

Year of fee payment: 18